Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
“I would nationalize Cloudflare. I would make it a national publicly run utility company.”
Guest:
Nick Merrill
Published:
Updated:
Duration:
30 min
Episode summary
In this episode, Nick Merrill, a research fellow at the UC Berkeley Center for Long-Term Cybersecurity, makes a cybersecurity case for nationalizing major CDNs such as Cloudflare, issues some pretty stark warnings about the dangers of machine learning and digs into why stereotypical images of hackers in hoodies doesn’t help anyone. His viewpoints are sobering if not controversial and worth listening to for anyone who cares about the future of the global internet.
Get a fresh perspective on some of the biggest risks to the global web: unchecked algorithmic bias, the risk of attacks on massive CDNs and the growing internet fragmentation.
Consider some of the boldest ideas from one of the sharpest thinkers when it comes to how policymakers can make fundamental changes to protect the internet.
Hear Nick’s take on why art matters in cybersecurity — and why stereotypical images of hackers in hoodies harm the public’s perceptions of information security.
Learn more about Fairness, Accountability and Transparency in Machine Learning and the growing movement to look more critically at the hidden algorithms that control the internet and much of technology today.
Consider how ransomware takedowns and other large-scale cyberattacks such as Colonial Pipeline erode public trust in technology.
Get a better understanding of why diversity in the cybersecurity industry matters when it comes to identifying real-world threats.
Threat models miss attackers who know victims Research on domestic violence survivors found real technology exploits that security teams missed because security tends to assume anonymous attackers who do not know their victims.
CDNs are the internet's bottleneck Nick says the internet's infrastructure is still largely decentralized except for CDNs, and a full compromise of even the second largest CDN could take much of the internet offline for ordinary users.
Panic is its own threat Gas prices rose after the Colonial Pipeline attack because people panic bought, which Nick sees as the real risk of ransomware and disruptive attacks.
Specific language helps the public His piece Don't Call It a Hack urged journalists to say cyberattack, data breach, criminal, or spy instead of hack and hacker, and he saw coverage shift over time.
Nobody's job is finding ML failures Nick worries that engineers who know about fairness and bias still cannot test an algorithm for it, and that no one is trained to find machine learning failures.
Topics covered
Talent Gap
Thought Leadership
Notable quotes
I would nationalize Cloudflare. I would make it like a national publicly run utility company.
…security tends to focus on anonymous attackers who don't know their victim in real life.
At some point, the panic becomes its own threat factor.
And the reason they keep me up is that it is nobody's job to find them. Nobody is being trained to go and identify machine learning failures.
Questions this episode answers
Why are CDNs a risk to the global internet?
CDNs sit between users and services and are highly centralized, so an outage at a CDN with about 5% market share already caused chaos. Nick says a deliberate attack that took one fully down could break the internet for everyday users. Read this section
Should Cloudflare be nationalized?
Nick says he would nationalize Cloudflare and run it as a publicly run utility with the highest possible security, though he doubts that would ever happen in the US. Read this section
Why did the Colonial Pipeline attack get so much attention?
Nick thinks people felt it in everyday life through gas prices, unlike SolarWinds or the Microsoft Exchange breach, and that it woke policymakers up to lax standards at privatized critical infrastructure companies. Read this section
What are machine learning failures?
Nick uses the term for bias and fairness problems, such as an algorithm trained on biased hiring decisions or on data lacking faces of Black people. He says these keep him up at night because no one is trained to find them. Read this section
Why do images of hackers in hoodies matter?
Nick argues imagery shapes how people and policymakers think, citing the internet as a series of tubes. The current reference points for cybersecurity are poor, which is why his center funds artists to make cybersecurity art. Read this section
About the guest
Nick Merrill is a researcher at the UC Berkeley Center for Long-Term Cybersecurity, where at the time of recording he directed the Daylight Lab. He studies cybersecurity through the lens of science and technology studies and came to research from a hacker community rooted in the Unix philosophy and the JavaScript node ecosystem. His PhD dissertation examined why people believe computers can read their minds.
And I'm Jeremiah Roe. Today, we're going to hear from Nick Merrill, a researcher at the UC Berkeley Center for Long Term Cybersecurity, where he directs the daylight labs.
Nick studies cybersecurity from a perspective that's informed by science and technology studies. We're going to get into some pretty cool and interesting stuff in this interview. Like, what happens if attackers go after a huge CDN and take the Internet offline?
That would be massive. So we're glad Nick is thinking about it, and we're looking forward to getting into it. First, here's a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers 20 fourseven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
We're super excited to have you here on the show. Really looking forward to this discussion. So I've heard you reference your approach to cybersecurity as rooted in science and technology. Could you tell us a little bit more about what that means and how that might differ from others' perspective here?
So I think what I probably said there was that it's rooted in science and technology studies. Science and technology studies, also known as STS. So science and technology studies, you know, we think about as kind of the true real story about how science is actually done. So, you know, a great example here, Einstein famously did not want to believe in quantum mechanics. He said God doesn't play dice with the universe. And there is a social story behind every kind of science, every kind of technology, what we see today, you know, I think it's popularly imagined as like, you know, these very weird kind of billionaires in Silicon Valley who are romping around building these things, and they have a very particular kind of political idea about how the world's going to work. So this is an example of the kinds of things that people think about in STS. And, you know, taking this STS kind of perspective to cybersecurity, one of the questions I'm asking is like, who is doing cybersecurity? Right? You have this weird confluence of hackers, which is where I came from before I did, you know, all of this kind of PhD stuff, and then you have people in kind of military, you have people who are kind of industry career professionals, and you know, these people all come at stuff from different angles, course.
They all have their own kind of weird mix of blind spots. There are some things that maybe none of them catch. And, you know, what we're trying to understand is kind of, you know, why, when does this matter? And what can we do to kind of shift the way that cybersecurity is done to make it work more effectively for different people? A great example I love to use here. My colleague Diana Freed at Cornell, she did these really amazing studies where she found that a lot of women who were in shelters for domestic violence, they were stalked or harassed using technology. The threat factors that were being exploited here, they were really legitimate threat vectors. These were exploits. But the security teams at these companies didn't catch them. And the question becomes, why did they miss this type of threat so systematically?
I think the point that you brought up about what I heard at least is that way that we look at these issues or the assumptions that we make about how cybersecurity happens can force us to make mistakes and to miss huge issues.
We want to catch these issues as much as we can. Obviously, we don't want to be in this position of finger wagging or saying, oh look at these stupid software developers. That's not helpful, that's not what we're trying to do. We're really trying to play a constructive role here, saying these are the things that are getting missed, here's what we can do to to make this a little bit better. And our ultimate outputs are practices, security practices, talking to policymakers in a way that helps rather than confuses them further.
So you mentioned that you kind of came from a background as a hacker, and now you do. I think you said this PhD stuff. But I was wondering if you would tell us a little bit more about your background.
Hacker means so many different things to different people. I came from this community that was really kind of... They were based here in Oakland at the time and have since kind of split up a bit, but they were really rooted in this kind of Unix philosophy and applied that to, at the time, node ecosystem in JavaScript. And, you know, there's a lot of... This was actually before, you know, React or any of these kinds of declarative ways of, you know, building modern web apps, but people were still really into web 2.0 and all that stuff. If you remember that time, people were just modifying web pages with Ajax requests. It was this crazy time where you could send a weird URL with some queries in it and it totally rewrites what's on the page. It was just this wild, wild west time. And I'm still wild west, but that was what I was doing at that time. That was my hobby. And I started a PhD and did all this other stuff.
I started learning about STS and learning about design research and all these things. I was thinking, oh my god, know, there's no one is applying this stuff to security, but it's so primed for this because it's this weird amalgamation of freaky people and also some really, really normal people. And it affects everybody. Right?
I was talking to someone recently who was interested in learning how to hack, which is a question that I get a lot and I think is funny because there's a million different ways. But the thing that I was talking to them about was for me, I feel like the way that hacking works is like, look at something and think about how the developers didn't expect you to use it. I feel like that's sort of what most of us say we have been hackers at any point. Like, that's what we did, right?
Yeah, totally. You know, actually, a while ago, wrote this piece called Don't Call It a Hack. And the idea was kind of talking to journalists saying, you know, don't say that this is a hack. Call it a cyber attack. Call it a compromise. Call it a data breach. And don't call them a hacker. Call them a criminal. Call them a spy. Whatever you wanna say. Use more specific language than this, because like you said, this word hacker got so diluted, it means different things to different people, and it became this totally useless way for describing what's actually happening in security. We were really serious about trying to get this to journalists saying don't do this, don't do this, don't do this, use these terms, use these terms. Amazingly, over time, we actually did see that behavior change. I'm sure it's different everywhere, but in major news outlets when people were covering the Colonial Pipeline breach, ransomware, you know, they use terms like ransomware, cybercriminal, instead of like, you know, the the pipeline is hacked.
And and this gives you so much more, you know, if you're an everyday person, you pick up the newspaper. This gives you so much more to reason with, gives you so much more analytical purchase on what's actually happening in the world than the word hack. Right?
You mentioned something of interest. Obviously, it's completely pertinent now, which is the Colonial Pipeline attack. So what's your particular take on that? And why do you think that so much attention has been paid there?
The one thing that is interesting to me about this attack, it sounds like it's the same thing that's interesting to you, which is like, this one? You know, right before Colonial Pipeline, there was SolarWinds, which was really widely covered. And after that, there was the Microsoft Exchange breach, and it's like very... It seems to me very likely that Chinese intelligence got literally every email from every government agency that uses exchange. This is huge! It wasn't even covered in the news as much, right? Why this one? I think it's just that people felt this one. You know, the price of gas went up, and also maybe something about America and its oil. But I think that, you know, people really, really felt this in their everyday life. And, you know, that's scary. It freaked people out. And remember, the gas prices did go up because of the outage. The gas prices went up because people panic bought the oil. And to me, that speaks to the real risk of ransomware in general, which is just that it freaks people out.
Right? And this pipeline was really big. But you know, I can imagine something even scarier happening, frankly, I'm sure we all can. And you know, when that happens, I think we're really going to be facing this widespread panic type threat. At some point, the panic becomes its own threat factor. I think that it woke policymakers up, certainly woke up the executive branch of the US government to say, this is a national security issue for real, these privatized companies that have lax standards.
Yeah. I mean, disinformation, misinformation, whatever you want to call it, fake news is a great example here. To me, breaking public trust, it's hard to define, right? But, I think one way to think about it is that there's this kind of aspect of social cohesion, trust in kind of everyday life. And this is not just about kind of trusting your neighbors, although it's an important aspect of it too, it's also about trusting that life is going to be predictable. I'm going to go to the grocery store, the prices are going to be about the same, you're free from fear of random violence, all of these things go together, right? And it's this big, big picture, I think, what makes that happen? What makes the good society and what makes the good life? And cybersecurity, it touches so many of them. And the errors cascade in this way that can be really unpredictable and really scary to the average person.
And I was thinking when Fastly went down earlier this week. Right? This big CDN. So many outages, so many things. It's like Amazon is outed as as a Fastly customer. And it's like, well, aren't they a Fastly customer or is something upstream of their build process a Fastly customer? You know?
That's scary. Imagine that your credit card isn't working, and you try to go online to see the news to see why it isn't working, and that doesn't work either.
Talk a little bit about something that you coined that says sort of cache rules everything around me, which is the acronym, CREAM that you gave, which is I I literally laughed out loud. That was hilarious.
I've got funding from the Internet Society to do some of this work. We're interested in internet centralization. Think that it's widely understood that the internet is owned by no one, at least that's what we're taught. It's this global network. And I think there's a lot of fear right now about different countries like Russia and China making their own nationalized internet. Sometimes people call this internet fragmentation, or the splinternet. There's a lot of anecdote and fear, especially among policymakers around this idea. About maybe 2019, we started to say, okay, you know, we need some measurement here. We need to really be able to discuss what's happening at a specific level, kind of the direction and velocity changes to the internet over time. There are a lot of things I can say here, but kind of the one that is really relevant to today's discussion is that, you know, as far as threats to the global internet, forget China and forget Russia and forget even Amazon or AWS.
It's these CDNs, these caching services that are so, so centralized that a failure in even the thing we saw last week, the second largest CDN, they have 5% of the market share, causes significant chaos, right? And this one was an outage. This was just an oopsie, they fixed it within, you know, an hour or something like that. And so imagine instead that this is an attack. Right? That Russia very maybe spearphishes or otherwise compromises critical systems at Fastly, and they're like really for real down, down, like all the way down, not just 85% of the network, 100% of the network is down. This is the second largest CDN that's not even Cloudflare. That would be really chaotic, right? Like, no one's buying anything on Amazon chaotic. And what I think is salient about this, right, that's going to hit the news big time.
That's going to be, you know, this last one was a front page story. So this is going be, you know, on the order of like a huge earthquake or natural disaster type story. Decentralization was really important to the internet back in the day. It really a key key design feature. And I think as much as we can probably all complain about tech monopolies, the internet basic infrastructure, it pretty much is decentralized still, except for CDNs, except for caching services. And because they kind of live between the user's query and the service response, it's this bottleneck, you know, it's the bouncer of the internet, it's the security guard of the internet, that lets the traffic come through from the general public. And if that gets compromised, the global internet for the average everyday person who's typing URLs into their URL bar is down. The internet is broken. When I think about Russia, I don't know if you remember, but maybe 2017, they did this drill where they disconnected themselves from the global internet.
The reason is that they don't want this dependence on this huge infrastructure that's highly centralized, and highly centralized in The United States. Because if The US had an executive order or something or some kind of law that said, hey, CDNs don't serve any traffic to a Russian originating IP address, then you've just created a tremendous firewall around the entire country of Russia, just from The United States. That's like really, really fundamentally how the Internet was not supposed to work. There's a lot of talk about antitrust in The US. CDNs are placed where you could go in and break them up. Right? You really could break up this market. And I think that there would be a really great security reason to do that.
Why do you think it is though that people don't notice this issue with CDNs being centralized? Like, you know, you mentioned that people are so worried about Google having a monopoly. People are worried about like, oh, China having their own separate internet. People notice these things. Why aren't they noticing CDNs?
You know, I don't really have a super good reason to this. But one thing I've observed, and this actually came to me from a colleague, Frédérick Douzet, she's based in Paris, and she had this great observation. Unfortunately, the paper's only in French, but her claim here is that there was all this talk about internet fragmentation, and it served this very specific goal from The US State Department side. You see this also, US State Department's really into internet freedom. But the other observation on the other side of this, and this is something we have data for, is that The US basically runs the internet. The US owns the internet. And when we want to take something down as The United States, what do they do? They go to ICANN, or they go to some other TLD registrar like GoDaddy, and they say, Hey, give us this domain name. And that power over the internet is a huge strategic asset for The US. It's analogous to controlling global trade. What we're seeing with Russia and China is that they're saying, hey, you know, I don't actually need to be part of this.
We can do our own thing, and certainly China's done it quite effectively in their way. You know, I think that freaks the US State Department out because it threatens this really amazing strategic advantage The US has.
So there's the CDN aspect, which is, you know, if you type in your URL inside the address bar inside of your browser and you click enter and, you know, what kind of happens in the background? Well, this is this is kinda what doctor Merrill is speaking about there. And that sort of background stuff, what happens is it's going to do some lookups for where you need to go, which then point to sort of IP addresses, and then it's going to send you to that location. Now if these things go down, then, you know, the important pieces is unless you know the actual IP of these locations of these things, you're not getting there. Is that right?
Yeah. Totally. And, you know, in some cases, nobody actually knows the IP address of Amazon except for Cloudflare. And the whole reason that Amazon uses Cloudflare is to make sure that that's the case, because you really do want protection from the general public. I want to really underline this: CDNs and people like Cloudflare, they provide an absolutely essential service, two absolutely essential services. The problem though, of course, is that they've become centralized to such a degree that they're central points of failure for the entire global internet. And also, you know, they're not regulated, even though they really are more like kind of a public utility than they are like a business.
So I've been in the cybersecurity industry for, you know, a while now, and obviously have had the pleasure of working with CDNs on multiple things, especially with with conducting sort of penetration tests and and Red Team operations, in a past life. And I've never actually thought of it this way. In my personal opinion, this is this is exceedingly interesting. It's it's it's sort of these little explosions are kind of going off in my head from, you know, what an attacker could potentially do here.
Yeah. I mean, they would you up. Like, imagine a Stuxnet level attack on Cloudflare. I mean, seriously, like, nobody's credit card would work, and you wouldn't be able to look up why.
I would nationalize Cloudflare. I would make it like a national publicly run utility company. And I would say, listen, there are advantages to using Cloudflare. We're going to run this with the highest possible security. We're treating this as important as a nuclear reactor.' then, I think that that's never going to happen in The US. I think that maybe if I recommended that to Canada, maybe there would actually be some more interest.
We're kind of on the topic of how could we do this better, specifically with CDNs, but I think this also applies to general areas of cybersecurity and being prepared for ransomware attacks and cybersecurity preparedness, I think in general. How do you think we can get the government and also the private sector to kind of work together on this in everyone's best interest?
Obviously at the Center for Long Term Cybersecurity, we think about the future a lot. It's a huge part of what we do. And there are better and worse ways to think about the future. A lot of the time when we think about the future, people tend toward the utopia and the dystopia. And most of the futures that you actually observe are really mundane. And so if you try to imagine here these mundane futures, where some change has unexpected effects, people use it in unexpected ways. And so as far as getting industry and government to work together, we've certainly seen the government try to do things like GDPR. And then what our tools allow us to do is say, okay, how are different stakeholders actually going to use or apply GDPR in practice? Unfortunately, there's no good prescription here for saying, oh, well, here's the formula, here's how you get companies in the industry to work.
Governments turn over every two to four years, and corporate culture changes rapidly. And under all of that, the technological landscape is shifting under our feet. What we at the Centre for Long Term Cybersecurity are trying to do is taking in these proposals, thinking about how they would actually play out, you know, over five, ten, fifteen years or whatever, and saying here are some scenarios, do you really want to do this now? Of course we try to make recommendations as well and flag things. And again, my colleague Jess Cousins, she goes to Sacramento to talk to lawmakers about machine learning. And also you have to give these meta ways for helping policymakers understand. So one of the things we do is that we run an arts contest. We fund artists, like studio artists, to make cybersecurity art.
And when I explain why this is important, I want to remind you I'm sure we all remember when Ted Stevens said that the internet was a series of tubes. Obviously he got a lot of, let's say, feedback on that comment. But a question that you might want to ask, I might ask myself, is why tubes? Why did he pick tubes? And when you look at like Wired magazine (this is two thousand and six), you look at Wired magazine in two thousand-two thousand and five or so, when they talk about the internet, they're like a bunch of tubes. It's like imagery of tubes, there are ones and zeros, you're inside of a tube, there's like a city that's connected by see through tubes. It's tubes everywhere. And the idea here is that imagery really, really affects the way people think about things. Art matters. Art provides us like a reference point or an anchor. And the reference points and anchors we have around cybersecurity are really bad.
Hackers is like, there's a hacker in a hoodie. He sits in like a dark room. He's typing on like a windows laptop. Right? And what does that represent? Like what does that tell you about the way the world works? And what we're not looking at are kind
of like, we don't need to Hollywoodify this as much as we've been doing, you know. What is the problem with the general public having this incorrect visual representation of this industry?
People make decisions about cybersecurity every second of every day. That's a fundamental perspective that I have. And, you know, mostly it's because they accept defaults. They open their phones. You know, they log into their Google account from their iPhone. They don't wanna turn on two factor because that shit's annoying, you know. And and and... Or, you know, they log... They check their email account on their phone, and they haven't enabled two factor on that email account. Right? These are all just really mundane ways. And if you go through your day and think about, oh my god, I just implicitly made a decision about cybersecurity, you'll see what I mean pretty quickly. And people make bad decisions a lot of the time. I think that security professionals basically believe that. I also think designers make bad decisions in providing bad defaults. I think that imagery stories are a wonderful way of helping people.
And we want to kind of get those stories out there in the least harmful way possible. So art is something that people interact with voluntarily. It's something that, for most people, I think a lot of their meaningful favorite things in life are pieces of art, movies, TV shows, music, something else. And we try to hook into that.
We talked a little bit a while ago, specifically when we were talking about ransomware, this idea of these attacks and these issues freaking people out. And we talked a little bit about that public trust issue. How could we potentially change our relationship with like cybersecurity and the general public to improve public trust or change this landscape?
When I try to prioritize this stuff, like what keeps me up at night for real, right? I talked about the cache thing that keeps me up at night for real. Another thing that really keeps me up at night is this idea of machine learning bias, which broadly is the idea you get this, you know, machine learning AI is algorithm and, you know, typical formulation would be that it learns from some past data. Let's say it learns about, you know, hiring decisions that that hiring managers have made. And then it learns, bias from those that data. So, you know, if they're biased against women, you get an algorithm that's biased against women. And carry more subtle formulations here where, you know, there's just some absence in the data, there aren't enough faces of black people. And so it is bad at identifying or categorizing black people or does so in a way that's harmful. And there are even more subtle formulations than that. But broadly defined, I call these issues around bias or fairness, I just call them machine learning failures.
These for real keep me up. And the reason they keep me up is that it is nobody's job to find them. Nobody is being trained to go and identify machine learning failures. You get a lot of people, and I work at Berkeley, I've seen a lot of grads to PhD students, let alone undergrads, go all the way through their education. They go work at a big company, you know, big tech company that you've heard of, and they work on machine learning algorithms there. And they know about fairness, they know about bias, but if you put an algorithm in front of them and you say, Hey, is this biased against black people? They would not know how to answer that question. That is the scariest thing that you could possibly know about the world if you have gotten yourself into the kind of same mindset I have, where it's like machine learning is really going to be everywhere. People are well attuned to the Terminator standpoint, the kind of the Terminator threat model, if you want to call it that.
I just watched a movie on Netflix not too long ago called Coded Bias that went into this issue with machine learning. And I remember watching it and being so excited about how every expert kind of talking about this issue that was highlighted in the movie at least. Were almost all women.
I love that movie. Yeah. But it was like all these women experts talking about this issue. And I was like, yes, look at these amazing women in the field, and a lot of women of color. And I was so jazzed. And then there was partway through the movie where I realized, and I'm making an assumption here, but I realized that maybe that's because those are the people that noticed the issue because it affected them.
So that's Joy Buolamwini. And I know a lot of people who were interviewed in that, they come from this community called FAT ML. It's like fairness, accountability, transparency, machine learning. And they published this conference and stuff. And it's this field that's just dominated by women and women of color in particular. Cybersecurity is headed in this direction of FAT ML. I mean, to my mind, the future of cybersecurity broadly is the future of machine learning. And the only tools we have for thinking about that are right now are fairness, accountability, transparency, the stuff that's going on in the FAT ML community. And what I would love to see is to have younger students of color, you know, in the high school kind of level or even below say, look at this, look at how amazing this stuff is, look at what's happening and look, you know, these are people who look like you who are doing this work and trying to make that into a funnel where, you know, I think a lot of students who come from disadvantaged backgrounds who are disproportionately students of color, they don't see security as something that matters to them.
It protects rich people and their money. And historically that has been what cybersecurity has done. But in the future, is going to protect, you know, people who are at the margins technically and in society. And we want, I think I would at least, you know, I think at CLTC, we all want to see cybersecurity lean into that identity and lean into these battles and these struggles that are just over the horizon here as a means and an end. Know, the means of course are increasing diversity in cybersecurity workforce and the end is, you know, protecting against this threat, which again, you know, really seriously keeps me up at night.
I would like to potentially shift gears for a moment. That brings me back to your dissertation on mind reading and telepathy. I was wondering if you could speak a little bit about that. Maybe what are three things that we should know about mind reading and telepathy?
Well, first thing I so regret titling my dissertation that all I get are emails from people who think that they're telepathic with their dog and they want me to prove it for them. That's thing number one. Okay. Thing number two is that, you know, what I was interested in here was this idea that people have that computers can read their minds. And people believe this, right? People believe that computers can read their minds. And the question became, okay, you know, how and why? And the answer is that, you know, people think that computers can know things about them that they cannot know. Like if you put, you know, a brain scanning device on someone, can't know what you're thinking, but they undervalue the risks that really matter. So, you know, if you have a GPS on someone, you can tell if they're depressed, you can tell if they suffer from clinical depression to pretty high confidence with just GPS trace data. People don't think about that. Right? So this is highlighting this mismatch between what people believe and what can actually be done and how it can actually be done.
It's this big, big security issue. It's this big security problem. And then the third thing is basically designers and engineers are this weird group of people who are really steeped in science fiction, and they absolutely believe that computers can read your mind. Also that that's a good thing and they want to do it and they want to know how. And that other process is the other thing I was studying in that dissertation, and how there are these two separate issues going on, these two separate streams of dialogue, and trying to make sense of that.
Wow. What a good question. You know, probably the number one thing for my LinkedIn profile is that I'm a big enthusiast of a drink called Kava, k a v a. It's traditionally from the South Pacific. And, you know, I I... It doesn't feature on my LinkedIn profile, but if you get to know me at all outside of professional context, it's probably the first thing you learn about me.
Do you know the difference between a Red Team and a Blue Team? Which has a higher signal to noise ratio? A crowdsourced security testing platform or a scanner? The Enterprise Security Testing 101 guide breaks down everything security testing related. Download it at synack.com. That's synack.com, or check out the show notes.
